   "Posix permissions for all private keys on disk."
   "rw-r-----")
 
+(def public-key-perms
+  "Posix permissions for all public keys on disk."
+  "rw-r--r--")
+
 (def private-key-dir-perms
   "Posix permissions for the private key directory on disk."
   "rwxr-x---")

            [clj-time.coerce :as time-coerce]
            [slingshot.slingshot :as sling]
            [puppetlabs.kitchensink.core :as ks]
            [puppetlabs.puppetserver.ringutils :as ringutils]
            [puppetlabs.ssl-utils.core :as utils]
            [clojure.set :as cset :refer [union]]

   csrdir :- schema/Str]
  (let [csr-path (path-to-cert-request csrdir subject)]
    (log/debug (i18n/trs "Saving CSR to ''{0}''" csr-path))
    (ks-file/atomic-write csr-path (partial utils/obj->pem! csr) public-key-perms)))

(schema/defn validate-duplicate-cert-policy!
  "Throw a slingshot exception if allow-duplicate-certs is false
